provider "alicloud" {
  region                = local.region
}

#first create alicloud oss and ots services storage terraform state and lock
#ots create table name "terraform_statelock",setting master key "T_ID",type "String"
terraform {
  required_version      = "~> 0.12"  
  backend "oss" {
    bucket              = "deeproute-terraform-resources"
    key                 = "stag/services/infrastructure"
    tablestore_endpoint = "https://terraform-status.cn-shenzhen.ots.aliyuncs.com"
    tablestore_table    = "terraform_statelock_table"    
    region              = "cn-shenzhen"
  }
}

module "ecs_policy" {
  source                        = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/ram/policy?ref=module.v1.0.2"
  ram_policy_name               = local.fullname
  ram_policy_document           = <<EOF
  {
    "Statement": [
      {
        "Action": [
          "oss:ListObjects",
          "oss:GetObject"
        ],
        "Effect": "Allow",
        "Resource": [
          "acs:oss:*:*:deeproute-terraform-resources",
          "acs:oss:*:*:deeproute-terraform-resources/*"
        ]
      }
    ],
      "Version": "1"
  }
  EOF
}

module "ecs_role" {
  source                        = "git@code.deeproute.ai:deeproute/ops-terraform.git//alicloud/ram/role?ref=module.v1.0.2"
  ram_role_name                 = local.fullname
  ram_role_document             = <<EOF
  {
    "Statement": [
      {
        "Action": "sts:AssumeRole",
        "Effect": "Allow",
        "Principal": {
          "Service": [
            "apigateway.aliyuncs.com", 
            "ecs.aliyuncs.com",
            "cr.aliyuncs.com"
          ]
        }
      }
    ],
    "Version": "1"
  }
  EOF

  enable_custom_policy                 = true
  attach_custom_policy_name            = ["${module.ecs_policy.ram_policy_name}"] 
  enable_system_policy                 = true
  attach_system_policy_name            = ["AliyunContainerRegistryFullAccess"]     
}
